QNAP Systems Inc Download Station vulnerabilities

3 CVEs affecting QNAP Systems Inc Download Station, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-39989, published 2026-10-15.

More from QNAP Systems Inc.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-39989, published 2026-10-15. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application…
• CVE-2026-39993, published 2026-10-15. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of…
• CVE-2026-34014, published 2026-10-15. High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days. An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the…